@companion-ai/feynman@0.3.45
Research-first CLI agent built on Pi and alphaXiv
AI Security Review
scanned 2mo ago · by lpm-firewall-aiInspectable install-time code is a Node version check, but the package still ships an unreadable 59MB runtime archive that the CLI extracts and a user-run installer that writes skills for other agents. That is dual-use payload and agent-extension risk without a concrete malicious install chain.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review
Trigger
npm install runs preinstall; invoking `feynman` restores the archive; running `scripts/install/install-skills.sh` writes skills for other agents.
Impact
Unreviewed archive contents may execute at CLI start, and an explicit skills install can extend Codex or OpenCode.
Mechanism
opaque bundled runtime archive plus optional foreign-agent skill install
AI rationale
Inspectable install-time code is a Node version check, but the package still ships an unreadable 59MB runtime archive that the CLI extracts and a user-run installer that writes skills for other agents. That is dual-use payload and agent-extension risk without a concrete malicious install chain.
Evidence
.feynman/runtime-workspace.tgzscripts/patch-embedded-pi.mjsbin/feynman.jsscripts/lib/runtime-workspace-restore.mjsscripts/install/install-skills.sh.feynman/npm$CODEX_HOME/skills/feynman.opencode/skills/feynman.agents/skills/feynman
Network endpoints4
feynman.is/installgithub.com/companion-inc/feynmanhuggingface.cous.i.posthog.com
Decision evidence
public snapshotAI called this Suspicious at 70.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The package ships a large opaque `.feynman/runtime-workspace.tgz` that cannot be read as text, then restores it on CLI start after a SHA-256 check.
- `bin/feynman.js` imports `scripts/patch-embedded-pi.mjs` on every launch, which extracts that archive into `.feynman/npm` and patches bundled Pi packages.
- A user-run skills installer copies downloaded prompts into Codex, OpenCode, or `.agents` skill directories.
- First-party tools spawn package managers and MCP connector processes; bundled vendor trees include HTTP credential providers and a WASM Doom example.
- Scanner AST coverage was incomplete and the tarball exceeds the inspectable size limit, so archive contents stay unresolved.
Evidence against
- npm `preinstall` only runs `scripts/check-node-version.mjs`, a Node version gate with no file, network, or agent-config mutation.
- There is no runtime self-dependency on `@companion-ai/feynman` and no unconsented preinstall write to a foreign agent control surface.
- Inspected first-party code is a research CLI wrapping Pi, with Hugging Face and science-database tools that match the stated product.
- `known_malware_source_similarity` hits are on bundled third-party files such as google-auth and highlight/marked, not a hidden dropper.
Source & flagged code
24 flaggedpackage.jsonView file
•scripts.preinstall = node ./scripts/check-node-version.mjs
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkgdist/setup/preview.jsView file
1import { spawnSync } from "node:child_process";
L2: import { BREW_FALLBACK_PATHS, PANDOC_FALLBACK_PATHS, resolveExecutable } from "../system/executables.js";
High
Child Process
Package source references child process execution.
dist/setup/preview.jsView on unpkg · L1extensions/research-tools/workbench-connectors.tsView file
361
Findings
1 Critical14 High9 Medium8 Low
CriticalTrojan Source Unicodedist/workbench-web/assets/index-BNB2OrGw.js
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/setup/preview.js
HighShellextensions/research-tools/workbench-connectors.ts
HighSame File Env Network Executionnode_modules/@earendil-works/pi-coding-agent/node_modules/google-auth-library/build/src/auth/googleauth.js#virtual:normalized:round1
HighCommand Output Exfiltrationnode_modules/@earendil-works/pi-coding-agent/examples/extensions/doom-overlay/doom/build/doom.js
HighSandbox Evasion Gated Capabilitybin/feynman.js
HighCloud Metadata Accessnode_modules/@aws-sdk/credential-provider-http/dist-es/fromHttp/fromHttp.js
HighShips High Entropy Blob.feynman/runtime-workspace.tgz
Affected versions and remediation
This report applies to @companion-ai/feynman@0.3.45.
See all versions of @companion-ai/feynman for other recorded verdicts.
- Review the evidence and your use of @companion-ai/feynman@0.3.45 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.